pricing background

Domain Reputation API Documentation

Domain Reputation API

ASK AI
The WhoisFreaks Domain Reputation API is a real-time domain threat assessment service. Given any domain name, it returns a comprehensive risk verdict, trust score, DGA (Domain Generation Algorithm) analysis, threat intelligence matches, and actionable security signals, all in a single API call.

Authorization

You can make authorized requests to our API by passing API key as a query parameter. To get your API key, login to our billing dashboard and get your API key! If your API key has been compromised, you can change it by clicking on reset button in billing dashboard.

Important References

  • For details on request limits and handling rate limiting, refer here
  • For a complete overview of API credit consumption and usage, refer here

Query Parameters

Required
  • apiKey
    Retrieve your API key from the billing dashboard.
  • domainName
    The domain name to assess (e.g., `example.com`). Must contain at least one dot, max 253 characters. Automatically lowercased.

Request

shellnodejsjavapythonphprubyjscsharpgocswiftjquery
SHELL
Loading request...

Response

Loading response...

Fields Description

Fields
Details
Data Type
Example
input
Input object containing the analyzed domain
domain
Domain name being analyzed
string
example.com
assessed_at
Timestamp when the assessment was performed
string (YYYY-MM-DDTHH:mm:ssZ)
2026-07-08T08:12:29Z
version
API/response schema version
string
1.0.0
processing_time_ms
Time taken to process the request, in milliseconds
string
742
risk_category
Overall risk assessment for the domain
verdict
Final verdict of the risk assessment
string
confidence
Confidence score for the verdict
string
0.94
primary_threat
Main threat type identified
string
phishing
severity
Severity level of the risk
string
threat_types
List of threat types associated with the domain
array
sources
Threat intelligence sources that flagged the domain
array
source
Name of the threat intelligence source
string
Spamhaus
indicator
Indicator matched by this source
string
example.com
threat_type
Threat type reported by this source
string
phishing
confidence
Confidence score from this source
string
0.97
first_seen
First time this indicator was seen by the source
string (YYYY-MM-DDTHH:mm:ssZ)
2026-07-01T10:22:00Z
last_seen
Last time this indicator was seen by the source
string (YYYY-MM-DDTHH:mm:ssZ)
2026-07-08T05:00:00Z
pivot_matches
Related pivots (NS, email, etc.) linked to known threats
array
pivot
Pivot value (e.g. nameserver or email)
string
ns1.exampledns.com
pivot_type
Type of pivot
string
total_related_threats
Total number of threats related to this pivot
string
34
confidence
Confidence score for the pivot match
string
0.92
dga_score
Domain Generation Algorithm (DGA) detection results
score
DGA likelihood score
string
0.81
is_dga
Indicates whether the domain is likely DGA-generated
boolean
true
model
Model used to compute the DGA score
string
deterministic_features_v1
features
Underlying lexical/statistical features used in DGA detection
domain_length
Length of the domain name
string
17
vowel_consonant_ratio
Ratio of vowels to consonants in the domain
string
0.18
ngram_perplexity
N-gram perplexity score of the domain string
string
3.91
shannon_entropy
Shannon entropy of the domain string
string
4.72
digit_letter_ratio
Ratio of digits to letters in the domain
string
0.23
consonant_streak_max
Maximum consecutive consonant streak in the domain
string
6
tld_in_known_dga_set
Indicates if the TLD belongs to a known DGA set
boolean
false
interpretation
Human-readable interpretation of the DGA score
string
trust_signals
Trust scoring and supporting signals for the domain
trust_score
Overall trust score
string
12
trust_band
Trust score band/category
string
signals
Signals contributing to the trust score
positive
Signals that positively affect trust score
array
code
Signal code identifier
string
valid_ssl
weight
Weight assigned to the signal
string
8
polarity
Polarity of the signal
string
positive
category
Category the signal belongs to
string
evidence
Evidence supporting the signal
string
TLS certificate issued by DigiCert
confidence
Confidence score for the signal
string
1.0
negative
Signals that negatively affect trust score
array
code
Signal code identifier
string
dmarc_missing
weight
Weight assigned to the signal
string
5
polarity
Polarity of the signal
string
negative
category
Category the signal belongs to
string
evidence
Evidence supporting the signal
string
No DMARC record
confidence
Confidence score for the signal
string
1.0
neutral
Signals that are neutral to trust score
array
code
Signal code identifier
string
content_unavailable
weight
Weight assigned to the signal
string
0
polarity
Polarity of the signal
string
neutral
category
Category the signal belongs to
string
evidence
Evidence supporting the signal
string
Website did not respond
confidence
Confidence score for the signal
string
1.0
indicators
Individual trust/risk indicators for the domain
is_newly_registered
Indicates whether the domain was recently registered
boolean
true
uses_free_extension
Indicates whether the domain uses a free TLD extension
boolean
false
uses_free_ssl
Indicates whether the domain uses a free SSL certificate
boolean
true
has_privacy_whois
Indicates whether WHOIS privacy protection is enabled
boolean
true
ssl_age_days
Age of the SSL certificate in days
string
18
has_dmarc
Indicates whether a DMARC record exists
boolean
false
has_spf
Indicates whether an SPF record exists
boolean
true
redirects_externally
Indicates whether the domain redirects to an external site
boolean
true
javascript_obfuscated
Indicates whether obfuscated JavaScript was detected
boolean
true
domain_age_days
Age of the domain in days
string
24
registrar
Domain registrar name
string
Namecheap
email_deliverability
Assessment of the domain's ability to send and receive email reliably
score
Overall email deliverability score out of 100
string
95
grade
Letter/word grade summarizing the deliverability score
string
can_receive_email
Indicates whether the domain is configured to receive email
boolean
true
authentication
Email authentication mechanisms configured for the domain
spf
Sender Policy Framework configuration
present
Indicates whether an SPF record was found
boolean
true
policy
SPF enforcement policy qualifier found in the record
string
record
Raw SPF DNS TXT record string
string
v=spf1 include:_spf.example.com -all
dkim
DomainKeys Identified Mail configuration
found
Indicates whether a DKIM record was found for any probed selector
boolean
true
selectors_found
List of DKIM selectors for which a record was found
array
["google"]
providers_detected
Email service providers inferred from the matched DKIM selectors
array
["Google Workspace / Gmail"]
note
Clarifying note about the limitations of DKIM selector probing
string
Only common selectors are probed; a domain may use a custom selector
dmarc
Domain-based Message Authentication, Reporting and Conformance configuration
present
Indicates whether a DMARC record was found
boolean
true
policy
DMARC enforcement policy applied to failing messages
string
reject
reporting_configured
Indicates whether DMARC aggregate/forensic reporting addresses are configured
boolean
true
infrastructure
Mail server infrastructure backing the domain
mx_count
Number of MX records found for the domain
string
2
mx_records
List of mail exchange server hostnames for the domain
array
["aspmx.l.google.com", "alt1.aspmx.l.google.com"]
mx_provider
Email hosting provider inferred from the MX records
string
google_workspace
null_mx
Indicates whether the domain explicitly declines email via a null MX record
boolean
false
reputation
Reputation and trust signals related to the domain's email sending history
spam_blacklisted
Indicates whether the domain appears on known spam blacklists
boolean
false
newly_registered
Indicates whether the domain was registered recently
boolean
false
domain_age_days
Age of the domain in days since registration
string
10500
issues
List of detected email deliverability issues or misconfigurations
array
code
Machine-readable code identifying the specific deliverability issue
string
severity
Severity level assigned to the detected issue
string
intelligence
Threat intelligence details for the indicator of compromise (IOC)
ioc_type
Type of the indicator of compromise
string
ioc_value
Value of the indicator of compromise
string
example.com
related_iocs
Other IOCs related to this domain
array
type
Type of the related IOC
string
ipv4
value
Value of the related IOC
string
93.184.216.34
confidence
Confidence score for the related IOC
string
0.91
feed_tags
Tags associated with this IOC from threat feeds
array
["verdict:suspicious", "severity:high", "campaign:phishing"]
stix_pattern
STIX pattern representation of the IOC
string
[domain-name:value='example.com']
recommended_action
Recommended action based on the assessment
string
block
first_seen
First time this IOC was observed
string (YYYY-MM-DDTHH:mm:ssZ)
2026-07-01T10:22:00Z
last_seen
Last time this IOC was observed
string (YYYY-MM-DDTHH:mm:ssZ)
2026-07-08T05:00:00Z
evidence_summary
Summary of reasons behind the risk assessment
why_flagged
List of reasons why the domain was flagged
array
["Detected in multiple phishing feeds", "Newly registered domain"]
errors
List of errors encountered during processing, if any
array
["WHOIS lookup failed", "DNS lookup timed out"]